Attention is currently required from: osmith. pespin has posted comments on this change. ( https://gerrit.osmocom.org/c/osmo-bsc-nat/+/28582 )
Change subject: bssap_conn: fix missing length check ......................................................................
Patch Set 2:
(1 comment)
File src/osmo-bsc-nat/bssap_conn.c:
https://gerrit.osmocom.org/c/osmo-bsc-nat/+/28582/comment/d77337ca_9b640c33 PS2, Line 60: len = IP_V4_ADDR_LEN;
see line 74: this function copies all existing IEs except for AOIP_TRASP_ADDR. […]
Ok I see. I think it would be a lot clearer by separating the 2 paths beforehand. gsm0808_enc_aoip_trasp_addr should take care of checking internally whether there's space in msg_new.
if (tag == GSM0808_IE_AOIP_TRASP_ADDR) { rc = gsm0808_enc_aoip_trasp_addr(msg_new, ss); } else { if (len >= msgb_tailroom(msg_new)) { LOGP(DMAIN, LOGL_ERROR, "Tailroom too small to encode tag %d into copy of bssmap msg\n", tag); msgb_free(msg_new); return -EINVAL; } rc = tlv_encode_one(msg_new, def->def[tag].type, tag, len, val); }